How do we know if user stopped or pause the search while running the splunk query

[harishsplunk7]

The query below is showing some details about ad-hoc searches. The “info” field in index=_audit has 4 possible values: completed, granted, canceled, failed.

I assume ‘granted’ means that the user was granted access to run the query, i.e., has the permission to access the indexes, run this type of query etc. I assume ‘canceled’ means that the query was cancelled. How do we know if it was cancelled by the user (user pressed the Stop button or Pause), or if it timed out by the system because it took too long to run ?

I found field fully_completed_search, but it is always true.
What would be some of the reasons to get a ‘failed’ status ?

[richgalloway]

There is no "query below" in the OP.

There should be a 'reason' field in the events that explains the info field.

[harishsplunk7]

There is no reason field in audit log to explaing the info, even i am not finding it anywhere splunk documentation. 

Is there any other way to get the search query stopped by user using splunk queries?